Personally I self host a domain that accepts anything@ and file it into a special inbox. This lets me give real addresses to specific sites and blacklist them as needed.
I did that, until I got the second run of someone sending spam to [dictionary]@mydomain.
Luckily this hasn't happened yet. Last time someone spammed my "throw away" domain I just took it offline (killed DNS) for a few days, that seemed to work :P
I hope you're doing anything@subdomain.example.com otherwise you'll get catchall spam.
Surprisingly, I haven't been getting catchall spam. If that happens I'll just write a quick interface to add permitted stuff through easily or just create a pattern that catchall won't use :)